An attacker was able to use a `field_id` from a "secret" field
and use if on any even the default public select2 view and
receive the data without authentication.
These changes introduce additional (optional) configuration parameters.
The parameters allow the user of the library to select different JS/CSS
libraries from the ones shipped. In particular, this allows serving from
the local server and/or in private-network-only environments.
Refs #220Closed#239
Patched ciritcal memory leak in ModelSelect2 widgets.
Boolean evaluation of queryset makes django fetch all
elements.
Thanks to @magicjohnson for discovering this issue
Currently there was no light version of the tag widget.
A light version might come handy if you use a postgres
`ArrayField` and a corresponding `SimpleArrayField`.
Resolved#226
The old multiprocessing support was hard to maintain.
Since signing and caching are part of `django.core`
there is really no need to stick to our own solution.
As a result multimachine support and security are now always in place.
Fields are stored in Django's cache. The default cache used by select2
is called 'default' but can be cachanged overwriting the setting
`SELECT2_CACHE_BACKEND`.
Recommended cache backends are memcached, redis or a DB-cache.
Refactored AutoResponseView
The main reason for this refactoring is
the fact that the pagingnation was slow.
I dropped major parts of the initial code
and wrote a more django-like-approach.
Noteabley:
- get_results now retuns a QuerySet
- This commit drops django 1.6 support in favour of the JsonResponse (Backporting is possible).
Symptoms:
While using AutoModelSelect2Field in admin site, I noticed that css files are rendered only at the first request to the add or edit forms, after that the widget is rendered but without loading any css files from get_select2_css_libs.
Solution:
I changed assets loading from Assets as a static definition to Media as a dynamic property as described at Django docs:
https://docs.djangoproject.com/en/1.8/topics/forms/media/#media-as-a-dynamic-propertyClosed#179
Squashed commit of the following:
commit f925ed4a118687b82b6f61d21a9104ccf00859c8
Author: Razi Alsayyed <razi.sayed@gmail.com>
Date: Fri Jun 19 01:39:47 2015 +0300
remove trailing whitespace from docstrings
commit b3f6553e422e19c8e065e026511c4ffd91ffee42
Author: Razi Alsayyed <razi.sayed@gmail.com>
Date: Fri Jun 19 01:35:15 2015 +0300
Remove blank lines from docstrings
commit 4490b78572a25069472933c88ebee48445b59972
Author: Razi Alsayyed <razi.sayed@gmail.com>
Date: Fri Jun 19 01:19:38 2015 +0300
construct Media the right way
Remove code that access private attributes of Media class.
commit 6697cd734daca62ff099be73d0685ce6af32e53d
Author: Razi Alsayyed <razi.sayed@gmail.com>
Date: Tue Jun 16 00:11:29 2015 +0300
fix
change _media to _get_media
I hope it is the final commit :)
commit 59bda01aed44e5658825a1bfe37ad09c5760a3ad
Author: Razi Alsayyed <razi.sayed@gmail.com>
Date: Tue Jun 16 00:09:35 2015 +0300
get_select2_heavy_js_libs
change get_select2_js_libs to get_select2_heavy_js_libs
commit 993e201355c9d5a6012e6f67cfa64462576c2570
Author: Razi Alsayyed <razi.sayed@gmail.com>
Date: Tue Jun 16 00:07:57 2015 +0300
fix
fix
commit f66e5f40b9f4df295bc5aaa7f2aafe588b2c41bb
Author: Razi Alsayyed <razi.sayed@gmail.com>
Date: Mon Jun 15 23:55:53 2015 +0300
fix
fix
commit d33d90278345bc32e80e20bdf782fd9ac5eb1800
Author: Razi Alsayyed <razi.sayed@gmail.com>
Date: Mon Jun 15 23:47:25 2015 +0300
fix
fix
commit f6d956149d2e99ee504c7b2c110f959f7472a181
Author: Razi Alsayyed <razi.sayed@gmail.com>
Date: Mon Jun 15 23:45:09 2015 +0300
fix
fix
commit 6d737a78cc07507c5b9b91736f6662b5f6f31c57
Author: Razi Alsayyed <razi.sayed@gmail.com>
Date: Mon Jun 15 23:40:01 2015 +0300
global name 'Media' is not defined
global name 'Media' is not defined
commit 661a817b092dc72bfa8df1a5458d474599c0a50e
Author: Razi Alsayyed <razi.sayed@gmail.com>
Date: Mon Jun 15 23:27:27 2015 +0300
Media as a dynamic property
**Symptoms:**
While using AutoModelSelect2Field in admin site, I noticed that css files are rendered only at the first request to the add or edit forms, after that the widget is rendered but without loading any css files from get_select2_css_libs.
**Solution:**
I changed assets loading from [Assets as a static definition](https://docs.djangoproject.com/en/1.8/topics/forms/media/#media-as-a-dynamic-property) to [Media as a dynamic property](https://docs.djangoproject.com/en/1.8/topics/forms/media/#media-as-a-dynamic-property) as described at Django docs.
